{
"ground_truth": [
{
"rule": "EXP40-C",
"file": "lapi.c",
"line": 1475,
"severity": "Low",
"desc": "lua_upvaluejoin writes through (UpVal**)&nullup (cast from const) when n out-of-range; api_check guard is no-op in release, causing UB write to static const object",
"confidence": "low",
"sqc_detected": false
}
],
"labels": [
{"rule": "DCL15-C", "file": "lapi.c", "line": 35, "verdict": "FP", "confidence": "high", "reason": "lua_ident is intentionally external; part of the public Lua version API"},
{"rule": "DCL19-C", "file": "lapi.c", "line": 35, "verdict": "FP", "confidence": "high", "reason": "File-scope version string intentionally global for embedder access"},
{"rule": "API00-C", "file": "lapi.c", "line": 109, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract: L is always valid; checking for NULL is not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 109, "verdict": "FP", "confidence": "high", "reason": "n is checked via api_check; overflow concern is advisory and api-contract-enforced"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 109, "verdict": "FP", "confidence": "high", "reason": "LUA_API is the public exported symbol; adding static would break ABI"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 126, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function; static would break ABI"},
{"rule": "API00-C", "file": "lapi.c", "line": 142, "verdict": "FP", "confidence": "high", "reason": "lua_atpanic is public API; L-null check is documented caller responsibility"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 152, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 167, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 167, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL13-C", "file": "lapi.c", "line": 167, "verdict": "FP", "confidence": "high", "reason": "Advisory const-qualify; L is opaque state pointer, const is incompatible with API"},
{"rule": "API00-C", "file": "lapi.c", "line": 174, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 174, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL13-C", "file": "lapi.c", "line": 174, "verdict": "FP", "confidence": "high", "reason": "Advisory only; lua_State* cannot be const in practice"},
{"rule": "API00-C", "file": "lapi.c", "line": 179, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 179, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 206, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 206, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL22-C", "file": "lapi.c", "line": 207, "verdict": "FP", "confidence": "high", "reason": "level is StkId reassigned from luaF_close return; no longjmp recovery path here; volatile not needed"},
{"rule": "API00-C", "file": "lapi.c", "line": 238, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 238, "verdict": "FP", "confidence": "high", "reason": "n is api_check validated; advisory-only overflow concern for stack index math"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 238, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 253, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 253, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 268, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 268, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 282, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 282, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 288, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 295, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 295, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 301, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 301, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 307, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 307, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 314, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 314, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 320, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 320, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 326, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 326, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 333, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 333, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 343, "verdict": "FP", "confidence": "high", "reason": "luaO_arith arguments are s2v() macro reads, not side-effecting calls; no sequencing issue"},
{"rule": "API00-C", "file": "lapi.c", "line": 349, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 349, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 369, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/buff null check not required by design"},
{"rule": "API00-C", "file": "lapi.c", "line": 369, "verdict": "FP", "confidence": "high", "reason": "buff is output param; null check is caller responsibility per API contract"},
{"rule": "API00-C", "file": "lapi.c", "line": 381, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 381, "verdict": "FP", "confidence": "high", "reason": "s is passed to luaO_str2num which handles null/empty; not a safety issue"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 381, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "STR34-C", "file": "lapi.c", "line": 382, "verdict": "FP", "confidence": "high", "reason": "s passed as const char* to luaO_str2num; no sign-extension involved at this call site"},
{"rule": "API00-C", "file": "lapi.c", "line": 389, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 389, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 399, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 399, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 409, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 409, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 437, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 455, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 455, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 464, "verdict": "FP", "confidence": "high", "reason": "o is always a valid TValue* from index2value; not a public API pointer param"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 464, "verdict": "FP", "confidence": "high", "reason": "touserdata is l_sinline (static inline); it already has internal linkage"},
{"rule": "API00-C", "file": "lapi.c", "line": 473, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 479, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 492, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 514, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 514, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 522, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 522, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 530, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 530, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 543, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/s null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 543, "verdict": "FP", "confidence": "high", "reason": "s is checked for len==0 case before use; API contract governs nullity"},
{"rule": "API05-C", "file": "lapi.c", "line": 543, "verdict": "FP", "confidence": "high", "reason": "Lua uses C89-style pointer params; conformant array syntax is not applicable"},
{"rule": "API00-C", "file": "lapi.c", "line": 555, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/s/ud null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 555, "verdict": "FP", "confidence": "high", "reason": "s is external string with documented non-null contract"},
{"rule": "API00-C", "file": "lapi.c", "line": 555, "verdict": "FP", "confidence": "high", "reason": "ud is optional userdata for allocator; API allows null per design"},
{"rule": "API05-C", "file": "lapi.c", "line": 556, "verdict": "FP", "confidence": "high", "reason": "Lua uses C89-style pointer params; conformant array syntax is not applicable"},
{"rule": "API05-C", "file": "lapi.c", "line": 556, "verdict": "FP", "confidence": "high", "reason": "Lua uses C89-style pointer params; conformant array syntax is not applicable"},
{"rule": "API00-C", "file": "lapi.c", "line": 570, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "MEM10-C", "file": "lapi.c", "line": 572, "verdict": "FP", "confidence": "high", "reason": "Direct NULL check for s is correct and intentional; no need for indirection function"},
{"rule": "MEM31-C", "file": "lapi.c", "line": 576, "verdict": "FP", "confidence": "high", "reason": "luaS_new returns GC-managed TString; explicit free is wrong; GC owns it"},
{"rule": "MEM31-C", "file": "lapi.c", "line": 583, "verdict": "FP", "confidence": "high", "reason": "ts is GC-managed; setsvalue2s roots it on the stack; no free needed"},
{"rule": "API00-C", "file": "lapi.c", "line": 587, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/fmt null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 587, "verdict": "FP", "confidence": "high", "reason": "fmt is required non-null format string; API contract enforces this"},
{"rule": "DCL30-C", "file": "lapi.c", "line": 594, "verdict": "FP", "confidence": "high", "reason": "ret holds pointer returned by luaO_pushvfstring pointing into GC string; not a local variable address"},
{"rule": "API00-C", "file": "lapi.c", "line": 598, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/fmt null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 598, "verdict": "FP", "confidence": "high", "reason": "fmt is required non-null format string; API contract enforces this"},
{"rule": "EXP33-C", "file": "lapi.c", "line": 602, "verdict": "FP", "confidence": "high", "reason": "pushvfstring macro calls va_start(argp,fmt) before use; sqc cannot trace macro expansion"},
{"rule": "DCL30-C", "file": "lapi.c", "line": 605, "verdict": "FP", "confidence": "high", "reason": "ret holds pointer into GC-managed Lua string; not a dangling local variable"},
{"rule": "API00-C", "file": "lapi.c", "line": 609, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 609, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP34-C", "file": "lapi.c", "line": 621, "verdict": "FP", "confidence": "high", "reason": "luaF_newCclosure calls luaM which longjmps on OOM; cl is never NULL on return"},
{"rule": "API00-C", "file": "lapi.c", "line": 636, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 636, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 647, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 647, "verdict": "FP", "confidence": "high", "reason": "p is light userdata pointer; null is a valid value in Lua (LUA_TLIGHTUSERDATA)"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 647, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 655, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 655, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP43-C", "file": "lapi.c", "line": 657, "verdict": "FP", "confidence": "high", "reason": "setthvalue(L, s2v(L->top.p), L): obj is stack slot, x is thread pointer; different objects, no aliasing"},
{"rule": "MEM31-C", "file": "lapi.c", "line": 672, "verdict": "FP", "confidence": "high", "reason": "luaS_new returns GC-managed TString; setsvalue2s roots it; no free needed"},
{"rule": "MEM31-C", "file": "lapi.c", "line": 682, "verdict": "FP", "confidence": "high", "reason": "str is GC-managed; already pushed onto stack via auxgetstr; no free needed"},
{"rule": "API00-C", "file": "lapi.c", "line": 699, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/name null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 699, "verdict": "FP", "confidence": "high", "reason": "name is required non-null global name string; API contract enforces this"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 699, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 707, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 707, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 713, "verdict": "FP", "confidence": "high", "reason": "luaV_fastget expands to single parenthesized expression; no unsequenced side effects"},
{"rule": "API00-C", "file": "lapi.c", "line": 721, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/k null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 721, "verdict": "FP", "confidence": "high", "reason": "k is required non-null field name; API contract enforces this"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 721, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 727, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 727, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 753, "verdict": "FP", "confidence": "high", "reason": "gettable is l_sinline helper; L is validated at all call sites in this file"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 753, "verdict": "FP", "confidence": "high", "reason": "gettable is l_sinline (static inline); already has internal linkage"},
{"rule": "API00-C", "file": "lapi.c", "line": 760, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 760, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 766, "verdict": "FP", "confidence": "high", "reason": "luaH_get is a function call with well-defined sequencing as a function argument"},
{"rule": "API00-C", "file": "lapi.c", "line": 772, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 772, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 782, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/p null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 782, "verdict": "FP", "confidence": "high", "reason": "p is light userdata pointer key; null is valid as Lua table key"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 782, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 792, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 792, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "MEM31-C", "file": "lapi.c", "line": 795, "verdict": "FP", "confidence": "high", "reason": "luaH_new returns GC-managed Table; sethvalue2s roots it on stack; no free needed"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 799, "verdict": "FP", "confidence": "high", "reason": "luaH_resize arguments evaluated in sequence as function call arguments; no UB"},
{"rule": "API00-C", "file": "lapi.c", "line": 805, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 805, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 832, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 832, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "MEM31-C", "file": "lapi.c", "line": 861, "verdict": "FP", "confidence": "high", "reason": "luaS_new returns GC-managed TString; passed to luaV_fastset and rooted; no free needed"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 871, "verdict": "FP", "confidence": "high", "reason": "luaV_finishset arguments are well-sequenced stack slot reads; no side effects in args"},
{"rule": "API00-C", "file": "lapi.c", "line": 878, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/name null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 878, "verdict": "FP", "confidence": "high", "reason": "name is required non-null global name; API contract enforces this"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 878, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 886, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 886, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 892, "verdict": "FP", "confidence": "high", "reason": "luaV_fastset macro expands to single parenthesized expression; no unsequenced side effects"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 896, "verdict": "FP", "confidence": "high", "reason": "luaV_finishset arguments are well-sequenced stack slot reads; no unsequenced side effects"},
{"rule": "API00-C", "file": "lapi.c", "line": 902, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/k null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 902, "verdict": "FP", "confidence": "high", "reason": "k is required non-null field name; API contract enforces this"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 902, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 908, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 908, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 934, "verdict": "FP", "confidence": "high", "reason": "luaH_set arguments are well-sequenced function call arguments; no unsequenced side effects"},
{"rule": "API00-C", "file": "lapi.c", "line": 940, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 940, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 945, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/p null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 945, "verdict": "FP", "confidence": "high", "reason": "p is light userdata pointer key; API allows null keys"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 945, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 952, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 952, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 958, "verdict": "FP", "confidence": "high", "reason": "luaH_setint is a single function call; no unsequenced side effects in arguments"},
{"rule": "API00-C", "file": "lapi.c", "line": 964, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 964, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1004, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 1004, "verdict": "FP", "confidence": "high", "reason": "n is validated via cast_uint range check at line 1011; not an overflow risk"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1004, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP30-C", "file": "lapi.c", "line": 1015, "verdict": "FP", "confidence": "high", "reason": "setobj arguments are macro expansions of struct field reads; no unsequenced side effects"},
{"rule": "PRE00-C", "file": "lapi.c", "line": 1029, "verdict": "FP", "confidence": "high", "reason": "checkresults macro: L is evaluated multiple times but only for reads of L->ci and L->top; no side-effecting L argument at any call site"},
{"rule": "PRE01-C", "file": "lapi.c", "line": 1029, "verdict": "FP", "confidence": "high", "reason": "L in checkresults macro is always a simple lua_State* variable; no precedence risk"},
{"rule": "PRE12-C", "file": "lapi.c", "line": 1029, "verdict": "FP", "confidence": "high", "reason": "checkresults macro: L is a simple pointer variable; multiple evaluation is safe"},
{"rule": "API00-C", "file": "lapi.c", "line": 1037, "verdict": "FP", "confidence": "high", "reason": "nargs is api_checkpop validated; overflow concern is advisory only for stack index"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1037, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL13-C", "file": "lapi.c", "line": 1069, "verdict": "FP", "confidence": "high", "reason": "Advisory const-qualify on ud void* parameter; standard pattern for user callback data"},
{"rule": "DCL00-C", "file": "lapi.c", "line": 1070, "verdict": "FP", "confidence": "high", "reason": "Advisory const-qualify on local; c is CallS struct initialized once and passed by address"},
{"rule": "API00-C", "file": "lapi.c", "line": 1076, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 1076, "verdict": "FP", "confidence": "high", "reason": "nargs is api_checkpop validated; overflow concern is advisory only for stack index"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1076, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1120, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/reader/data/chunkname/mode null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 1120, "verdict": "FP", "confidence": "high", "reason": "data is opaque reader userdata; API allows null"},
{"rule": "API00-C", "file": "lapi.c", "line": 1120, "verdict": "FP", "confidence": "high", "reason": "chunkname is guarded: if (!chunkname) chunkname = '?'; already safe"},
{"rule": "API00-C", "file": "lapi.c", "line": 1120, "verdict": "FP", "confidence": "high", "reason": "mode is passed to luaD_protectedparser; null handled downstream"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1120, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1149, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/writer/data null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 1149, "verdict": "FP", "confidence": "high", "reason": "data is opaque writer userdata; API allows null"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1149, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1163, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1163, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL13-C", "file": "lapi.c", "line": 1163, "verdict": "FP", "confidence": "high", "reason": "Advisory const-qualify; lua_State* cannot be const in this context"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1171, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL00-C", "file": "lapi.c", "line": 1174, "verdict": "FP", "confidence": "high", "reason": "g is assigned once but accessed many times via members; const advisory has no safety value"},
{"rule": "INT14-C", "file": "lapi.c", "line": 1175, "verdict": "FP", "confidence": "high", "reason": "g->gcstp is deliberately a bitfield; mixed arithmetic/bitwise ops are intentional GC design"},
{"rule": "EXP07-C", "file": "lapi.c", "line": 1195, "verdict": "FP", "confidence": "high", "reason": ">> 10 is standard Kbytes conversion documented in Lua source comment; not an assumed constant"},
{"rule": "API00-C", "file": "lapi.c", "line": 1258, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1258, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1273, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1273, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1289, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1289, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1300, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1300, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1315, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1315, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1325, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1325, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "API00-C", "file": "lapi.c", "line": 1335, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1335, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "DCL13-C", "file": "lapi.c", "line": 1335, "verdict": "FP", "confidence": "high", "reason": "Advisory const-qualify on ud; standard allocator userdata pattern"},
{"rule": "API00-C", "file": "lapi.c", "line": 1343, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1343, "verdict": "FP", "confidence": "high", "reason": "lua_setwarnf is a public API function; static linkage would break ABI"},
{"rule": "DCL13-C", "file": "lapi.c", "line": 1343, "verdict": "FP", "confidence": "high", "reason": "Advisory const-qualify on ud; standard warn userdata pattern"},
{"rule": "API00-C", "file": "lapi.c", "line": 1351, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L/msg null checks are caller responsibility"},
{"rule": "API00-C", "file": "lapi.c", "line": 1351, "verdict": "FP", "confidence": "high", "reason": "msg is required non-null warning message; API contract enforces this"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1351, "verdict": "FP", "confidence": "high", "reason": "lua_warning is a public API function; static linkage would break ABI"},
{"rule": "API00-C", "file": "lapi.c", "line": 1359, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "MEM33-C", "file": "lapi.c", "line": 1380, "verdict": "FP", "confidence": "high", "reason": "*val = &f->upvalue[n-1] is pointer assignment to TValue slot, not struct copy; no flexible array member copy"},
{"rule": "API00-C", "file": "lapi.c", "line": 1400, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 1400, "verdict": "FP", "confidence": "high", "reason": "n is range-checked in aux_upvalue via cast_uint idiom; no overflow risk"},
{"rule": "DCL30-C", "file": "lapi.c", "line": 1410, "verdict": "FP", "confidence": "high", "reason": "name holds pointer to string literal or GC-managed TString data; not a local variable address"},
{"rule": "API00-C", "file": "lapi.c", "line": 1414, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 1414, "verdict": "FP", "confidence": "high", "reason": "n is range-checked in aux_upvalue via cast_uint idiom; no overflow risk"},
{"rule": "DCL30-C", "file": "lapi.c", "line": 1429, "verdict": "FP", "confidence": "high", "reason": "name holds pointer to string literal or GC-managed TString data; not a local variable address"},
{"rule": "DCL30-C", "file": "lapi.c", "line": 1439, "verdict": "FP", "confidence": "high", "reason": "*pf = f assigns heap LClosure* through output pointer parameter; not a dangling local assignment"},
{"rule": "API00-C", "file": "lapi.c", "line": 1447, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "API00-C", "file": "lapi.c", "line": 1447, "verdict": "FP", "confidence": "high", "reason": "n is range-checked inside getupvalref; no overflow risk"},
{"rule": "API00-C", "file": "lapi.c", "line": 1469, "verdict": "FP", "confidence": "high", "reason": "Lua C API documented contract; L null check not required"},
{"rule": "DCL15-C", "file": "lapi.c", "line": 1469, "verdict": "FP", "confidence": "high", "reason": "LUA_API exported public C API function"},
{"rule": "EXP40-C", "file": "lapi.c", "line": 1472, "verdict": "FP", "confidence": "high", "reason": "getupvalref returns UpVal** (non-const pointer); no const circumvention at this assignment"},
{"rule": "EXP34-C", "file": "lapi.c", "line": 1474, "verdict": "FP", "confidence": "high", "reason": "up1/up2 are always non-null UpVal** from getupvalref; api_check verifies *up1 and *up2 are non-null"},
{"rule": "EXP34-C", "file": "lapi.c", "line": 1474, "verdict": "FP", "confidence": "high", "reason": "up2 is always non-null pointer from getupvalref; dereference is safe"},
{"rule": "MEM33-C", "file": "lapi.c", "line": 1475, "verdict": "FP", "confidence": "high", "reason": "*up1 = *up2 assigns UpVal* (pointer value), not a flexible array member struct copy"},
{"rule": "EXP33-C", "file": "lapi.c", "line": 1476, "verdict": "FP", "confidence": "high", "reason": "f1 is initialized by getupvalref(&f1) call on line 1472 before use on line 1476"}
],
"fns": [
{
"file": "lapi.c",
"line": 1475,
"rule": "EXP40-C",
"severity": "Low",
"desc": "lua_upvaluejoin: getupvalref returns (UpVal**)&nullup (const cast away) for invalid n; api_check guard is no-op in release; *up1 = *up2 then writes through pointer to static const object (UB). Low confidence: only reachable with invalid upvalue index.",
"upstream_present": true
}
],
"files_reviewed": ["lapi.c"],
"files_clean": [],
"summary": {
"ground_truth": 1,
"tp": 0,
"fp": 226,
"fn": 1
}
}